feat: Nginx access log ingestion — structured per-request events

[jmrGrav]

Context

The current pipeline ingests CrowdSec decisions and Cloudflare WAF events. Nginx access logs are not ingested as structured events — they are only read for ban decisions via the burst counter.

Goal

Parse nginx access log entries into structured SecurityEvent records and store them in the timeline.

Scope

• Nginx log format auto-detection (combined / custom)
• Per-request event: IP, method, URI, status, bytes, referer, UA, timestamp
• Tail mode: follow live log file
• Batch ingest: process existing log on startup
• Deduplication: skip already-ingested lines (by offset or hash)
• CorrelationID assignment (see companion issue)

Non-goal

OpenResty/Lua event enrichment (future)

Risk

Log file permissions. Daemon runs as non-root for UI; nginx log may require group membership.